Privacy policy

SnapSake is a private photo library. Your photos are visible to you and to the people you explicitly share them with. We don't run ads, we don't use third-party analytics, and we don't sell or rent your data to anyone.

SnapSake is a small, independent project run by an individual, not a company. It's currently offered free of charge as a test with friends. For any privacy question or request, email [email protected].

Only what the app needs to work:

• Account details. Your username, your email address and a password. Your username is shown to other people (for example when they add you as a friend or you share a photo); your email address is not. Passwords are hashed by our authentication provider — we never see or store the password itself.
• Your photos. The files you upload, their filenames and sizes, and a SHA-256 fingerprint of each file that lets us reject duplicate uploads and enforce the sharing limit.
• Sharing records. Which account each photo is shared with, and the lifetime list of people a photo has ever been shared with.
• Usage figures. How much storage your account is using, so the quota can be enforced.
• Data on this device. Your login session, and your theme, grid density and delete-confirmation preferences, kept in your browser's local storage.
• Basic server logs. Our hosting providers record requests (IP address, browser type, timestamps) for security and abuse prevention.

• No advertising identifiers, tracking pixels or third-party analytics.
• No contact-list or address-book access — you type or pick a friend yourself.
• No location data, and no access to photos you haven’t chosen to upload.
• We do not sell, rent or trade personal data.

Each photo has its own recipient list. A photo appears in a friend's library only while you have it shared with them; removing them takes it out of their library. Access is enforced in the database, and photo files are served through links that expire after five minutes.

Sharing gives someone access — it can't control what they do with it. A recipient can download or screenshot a photo while it's shared with them, and we can't take that copy back. Shared photos count against the uploader's storage, not the recipient's.

We use three infrastructure providers, who handle data only on our instructions:

• Supabase — accounts and database.
• Cloudflare (R2) — storage of the photo files.
• Vercel — hosting and delivery of the app.

These providers may process data outside your country, including in the United States. Data is transmitted over HTTPS.

• Photos stay until you delete them or delete your account. Deleting a photo removes the file from storage and its record from the database.
• After a photo is deleted we keep a record of its fingerprint and who it was shared with, with no image and no filename. That record is what stops deleting and re-uploading from resetting the lifetime sharing limit.
• Account details stay until the account is deleted.
• Server logs are kept by our providers for a short period and then discarded.

You can delete any photo from the photo viewer at any time. Account deletion isn't self-service yet — email [email protected] from the address on the account and we'll delete the account, its photos and its records. We may ask you to confirm you own the account first.

Depending on where you live you may have further rights — to access a copy of your data, correct it, delete it, restrict or object to processing, or receive it in a portable format. You can exercise any of them by emailing us, and you can complain to your local data-protection authority. We don't sell personal information as defined by California law.

Photos sit in a private storage bucket, reachable only through short-lived signed links, and database access is restricted row by row so you can only see your own photos and the ones shared with you. Privileged keys live only on the server. No service is perfectly secure, but if a breach ever affects your data we'll tell you and the relevant authorities without undue delay.

SnapSake isn't intended for children. You must be at least 13 years old to use it, and old enough to consent to data processing where you live. If you believe a child has created an account, email us and we'll remove it.

We may update this policy as the app changes. The date at the top always shows the current version, and significant changes will be announced in the app before they take effect.